Security flaws signal early death of Windows Gadgets
Summary: Microsoft is pulling the plug on the Windows Sidebar and Gadgets platform ahead of news that security vulnerabilities will be disclosed at this year's Black Hat conference.
According to a brief abstract from the Black Hat site, researchers Mickey Shkatov and Toby Kohlenberg plan to discuss weaknesses associated with Windows Sidebar and Gadgets and demonstrate "nastiness" that can be done on the platform.
[ Microsoft drops surprise IE patch, fixes under-attack Windows zero-day ]
"Gadgets are comprised of JS, CSS and HTML and are application that the Windows operating system has embedded by default. As a result there are a number of interesting attack vectors that are interesting to explore and take advantage of. We will be talking about our research into creating malicious gadgets, misappropriating legitimate gadgets and the sorts of flaws we have found in published gadgets," the researchers said.
Microsoft was already planning to deprecate Sidebar and Gadgets in the upcoming Windows 8 but, after working with Schkatov and Kohlenberg ahead of Black Hat, the company decided to push for the immediate death of the platform.
From the MSRC blog:
As many of you are aware, Windows 8 will deprecate the Sidebar and Gadgets, and Gadget developers are already shifting their efforts to the online Windows Store. Meanwhile, we’ve discovered that some Vista and Win7 gadgets don’t adhere to secure coding practices and should be regarded as causing risk to the systems on which they’re run. With time running out for the Sidebar and Gadgets and with developers already moving on, we’ve chosen to deprecate the Windows Gadget Gallery effective immediately, and to provide a Fix it to help sysadmins disable Gadgets and the Sidebar across their enterprises.
The company released a security advisory with information to help system administrators disable the Windows Sidebar and Gadgets on supported versions of Windows Vista and Windows 7 with one Fix it click.
Microsoft did not provide details on the vulnerabilities but warned that there is a risk of remote code execution attacks.
"An attacker who successfully exploited a Gadget vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take complete control of the affected system," Microsoft warned.
This automated Fix-It will disable the Windows Sidebar experience and all Gadget functionality on affected machines.
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
Deprecate - a daft word
from WP deprecation is a status applied to features, characteristics, or practices to indicate that they should be avoided, typically because they have been superseded.
In other words what they are saying is, 'You might want to think twice before you use this gadget.
At home we love the temperature gadget as well as the currency converter and calendar.
Another EPIC FAIL on MS's part
Now they can't even lock them down. What a joke.
it's not just WP terminology
But Somewhat Misused
Its spin doctoring to leverage that connotation when you really mean removed without successor due to secure implementation being unfeasible.
However, this use is not unknown, since MS is certainly not the first corp to spin doctor product failure and withdrawal under this term nor is this MS first use.
Latin etymology
pot; kettle; black
I guess we're all supposed to "k-n-o-w" that it is 'Word Press.' ?
I do agree that 'deprecated' is a rather idiotic term. Better terms might be "replaced," "superseded" or "tossed in the junk-pile."
;-)
More direct?
Better Single words?
Exiled
or outlawed (maybe too far but clear about what actions to take)
Two words "dishonorably discharged" are 100% accurate summary of situation and recommended actions.
Three words "marked for deletion" would be 100% clear about status and recommendations though. Four words
Severed
Get yourself a new dictionary
Yeah...deprecate wins every time!
"Deprecate": Why not just say what you mean?
I like my Windows Gadgets
Ditto for the, what was it called in Vista, the animated wallpapers...
The last I recall, Aero is going to get a similar fate - to get the frosted glass look takes GPU power. Tablets have as much power as a tranquilized gnat. So rescind that while finding an excuse to shroud or bypass the actual truth with... (and, quite honestly, Win7's GUI looks more professional with it when enabled, but whatever - it's being nixed for Win8, whose GUI, plain as it is, at least feels relevant - for tablets and phones and other touch-based screens of a certain size...)
"RESCIND" is the most honest description.
RESCIND means to cancel/withdraw from use.
Which is the more honest description?
Now I am in two minds
They marketed the OS with this feature...
I admittedly stopped using them mostly when I went from Vista to Win7, but that was mainly due to laziness and retraining myself because they were hidden now by default (at least in some version of win7, not sure about 'home' versions). People whining that they're a resource hog are probably the type that will whine no matter what, it consumes very little actual cpu, memory, or disk resource.
Forcing me?
if anything is play skool, its OSX
They tried again to integrate web IT directly into the desktop...
a) They chew resources like a hungry bear - tried many over the years, even developed for a couple, but they ALL add a tonne of bloat to all but the high-end systems
b) Integrating web-tech into the PC user-interface ALWAYS represents a hazard (unless severely sandboxed making far less usable in most OS's)... it is just a matter of how much attention that given platform receives from hackers and malware writers... unfortunately in the case of MS and Windows, that will always be a lot of attention.
Sorry to add factual info amongst all the rants but there you go...
So I Guess
Instead of fixing the capability I guess they are killing it so they can say the functionality is replaced by live tiles in Win8. They really don't replace the functionality because gadgets can be seen while an application is running windowed, something that can't be done in Win8 with live tiles.